Volumetric DDoS attack

Volumetric DDoS attacks are the simplest and most common type of denial‑of‑service attack.

• UDP Flood: Sends large numbers of UDP packets to random ports, forcing the server to check each port and reply with “destination unreachable,” wasting CPU and bandwidth. Easy to spoof due to UDP’s connectionless design.
• ICMP Flood (Ping Flood): Overwhelms the target with ICMP Echo Requests, consuming both bandwidth and processing power as the system attempts to respond.
• Amplification/Reflection Attacks (DNS, NTP, SSDP, CLDAP, Memcached): Attackers spoof the victim’s IP and send tiny queries to public servers that respond with much larger replies, massively amplifying attack volume. DNS amplification is one of the most widely used.

Application Layer Attacks (Layer 7)

These target the actual application (e.g., web servers, APIs, databases) by mimicking legitimate user behavior. They consume server resources like CPU, memory, or database connections rather than just bandwidth. Often measured in requests per second (rps). They are stealthier and increasingly common.

Common subtypes:

• HTTP/HTTPS Flood (GET/POST Floods): Bots send high volumes of seemingly normal requests (e.g., page loads or form submissions) to exhaust application resources. HTTPS variants add encryption overhead.
• Slowloris / Slow POST (RUDY): “Low and slow” attacks that open many connections and send partial HTTP requests or data very slowly, keeping connections open and tying up server threads without triggering volume thresholds.
• Other advanced L7: API abuse, GraphQL introspection, HTTP/2 Rapid Reset (exploits stream resets), or targeting expensive endpoints (e.g., login, search, or AI queries).

Layer 7 attacks are challenging to mitigate because traffic looks legitimate; they often require behavioral analysis, rate limiting, or WAFs (Web Application Firewalls)